Report | CyberRatings Cloud Firewall Test Results Q1, 2025

Q1 2025 | CNFW In Q1 2025, CyberRatings.org conducted independent evaluations of leading cloud firewall solutions using the Cloud Firewall Test Methodology v3.0. These assessments included offerings from Cloud Service Providers (CSPs) and third-party security vendors, typically available through CSP marketplaces. This report outlines the findings from CyberRatings’ testing of Check Point’s Cloud Network Firewall solution. The evaluation covered key performance metrics: exploit block rate, evasion effectiveness, false positive management, TLS/SSL 1.2 and 1.3 support, and system stability under adverse conditions. The firewall was tested using real-world attack scenarios, enterprise-grade workloads, and adversarial evasion techniques to measure its resilience, reliability, and performance.

Executive Summary

The CloudGuard Network Security Next-Gen Firewall with Threat Prevention (R81.20 Jumbo Hotfix Take 89), running on AWS c6i.xlarge, was tested using CyberRatings.org Cloud Network Firewall methodology version 3.0. Our testing determined that the Check Point CloudGuard provides excellent exploit and evasion detection, TLS/SSL inspection, and reliability while generating no false positives. Consequently, CyberRatings assesses that it is an excellent choice for organizations seeking strong protection for their cloud deployments.
Key Findings

• Security Effectiveness: 100.00% — One of only two products achieving 100%.
• Exploit Block Rate: 100.00%
• Evasion Effectiveness: 100.00%
• Successfully identified and mitigated 2,500 attacks across 27 categories of evasion techniques from network layer 3 to layer 7.
• TLS/SSL Support: 100.00%
• False Positive Accuracy: 100.00%
• Rated Throughput: 390 Mbps

How We Tested

• False Positives: 2,760 samples from various business-critical files and applications, ensuring security measures did not disrupt legitimate traffic.
• Exploits: 2,028 attack samples from widely exploited vulnerabilities in enterprise environments.
• Evasion Techniques: 2,500 attacks spanning 27 evasion techniques tested across multiple network layers to bypass firewall defenses.
• Performance Metrics: 46 different stress and capacity tests under diverse workloads.
• Stability & Reliability: Seven extended tests simulating prolonged real-world attack and operational scenarios.

These comprehensive benchmarks highlight the effectiveness of the cloud firewall in delivering reliable threat prevention, operational stability, and minimal disruption to legitimate traffic. Organizations can utilize these results to make informed decisions when selecting a cloud network firewall for modern enterprise environments.

Overview

Organizations securing cloud infrastructure must evaluate Cloud Network Firewalls (CNFWs) based on integration, security capabilities, operational needs, billing, and cost. A firewall’s effectiveness directly impacts an organization’s ability to defend against cyber threats. Therefore, objective testing is essential to ensure firewalls provide the expected protection. This test compared firewalls from Cloud Service Providers (CSPs) and third-party security vendors. Third-party firewalls were deployed on Amazon Web Services (AWS). Each product met specific baseline security requirements and adhered to best practices. Testing focused on real-world attack methodologies, validating both security and performance claims.

Test Topology

The figure below illustrates the testing topology used for this round of testing.

Security Effectiveness

Security effectiveness tests verified how effectively the firewall protected network access, applications, and users while preventing threats (exploits and evasions), blocking malicious traffic under extended load, and remaining resistant to false positives.

Routing & Access Control

Firewalls must support stateful inspection, enforce security policies, and prevent unauthorized access across network segments. Proper network segmentation is crucial for preventing lateral movement by attackers. This test ensured that security policies were correctly enforced.
Results

• Unrestricted Traffic Test (Allow All): Pass
• Segmented Traffic Test: Pass

Access Control Results

• Simple Policies: Pass
• Complex Multi-Zone Policies: Pass

TLS/SSL Support

TLS/SSL encryption is now the standard for secure communication but can also conceal malicious traffic. We evaluated the capabilities of cloud network firewalls in supporting a wide range of cipher suites and effectively inspecting encrypted payloads, achieving 100.00%.

Decryption Validation

• Supported Top 5 Cipher Suite Support: 5/5
• Decryption Bypass Exceptions: Supported
• TLS 1.2 Session Reuse - Session Tickets: Supported
• TLS 1.2 Session Reuse - Session IDs: Supported

False Positive Accuracy

This test measured how well the firewall distinguished between legitimate and malicious traffic.
False Positive Categories

• System Files (.dll, .lib, etc.): 100.00%
• Executables (.exe,.msi, etc): 100.00%
• Productivity (.sh,.json, .xlsx, etc.): 100.00%
• Compressed Files (.zip, .gz, .cab, .tar, etc.): 100.00%
• Media (.png, ico, etc.): 100.00%
• Other files: 100.00%

Exploits

This test verified the firewall’s ability to detect and block exploits targeting known vulnerabilities.
Exploitation Effectiveness: 100.00%
Coverage by CVE Classification:

• CVE Critical Classification: 100.0%
• CVE High Classification: 100.0%

Evasions

This test verified the firewall’s ability to detect and block known evasion techniques.
Evasion Effectiveness: 100.00%

Performance

The cloud network firewall’s performance was evaluated under various traffic conditions.
Rated Throughput: 390 Mbps
HTTP and HTTPS Capacity:

• Max HTTP TPS: 18,216
• Max HTTPS CPS: 1,756

Cost of Tested Configuration

To assess the overall value of a firewall solution, security effectiveness should be evaluated alongside its cost.
Total Cost for one month: $1,710.00
Price per Mbps Calculation:

• Cost: $1,710
• Tested Throughput (Mbps): 390
• Price per Mbps: $4.38

Scorecard Summary

Special Thanks

We want to issue a special thank you to Keysight for providing their CyPerf and BreakingPoint tools for us to test the performance, TLS functionality, and stability of Cloud Network Firewalls.
Authors: Thomas Skybakmoen, Ahmed Basheer, Tim Otto, Vikram Phatak
Contact Information: CyberRatings.org
515 South Capital of Texas Highway Suite 225 Austin, TX 78746
info@cyberratings.org
www.cyberratings.org
© 2025 CyberRatings. All rights reserved.